Vulnerability Disclosure Policy

1. Scope

This policy covers the Arush Labs website (arushlabs.vercel.app) and Arush Labs products, including Arush Automation and its dashboard, API and connected integrations.

2. How to Report

Email hello@arushlabs.com with the subject line "Security Report", including: a description of the issue, steps to reproduce, affected URL/endpoint, and any proof-of-concept (without accessing other customers' data).

3. Guidelines for Researchers

• Give us reasonable time to investigate and remediate before any public disclosure.
• Do not access, modify, or delete data belonging to other customers.
• Do not run automated scanning that degrades service availability for other users.
• Do not attempt social engineering, phishing, or physical attacks against our team or customers.
• Only interact with test accounts you control, or clearly non-destructive proof-of-concept requests.

4. Our Commitment

We will acknowledge reports in good faith, investigate promptly, keep you reasonably informed of progress, and will not pursue legal action against researchers who follow this policy in good faith.

5. Out of Scope

• Reports generated purely by automated scanners without a demonstrated impact.
• Missing security headers or best-practice recommendations without a demonstrated exploit.
• Denial-of-service or volumetric attacks.
• Social engineering against Arush Labs staff or customers.